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PROPOSED AMRNniVlli- NTS TO THF. PI ATMs. 

1 . (Currently amended)A method in a data processing system for tracking 
relationships between programs and data, the method comprising: 

receiving a file access request fiom a program, wherein the file access request k 
for a file and is received at an operating system level; 

identifying an association between th. fil. the nmpr^n, r^ uesting the fit, 
access in response to rfirpi vjng the filn arress req uest; anH 

storing the [[m]] association between the file and the program^jvhereinflie 
a s sociation is used for suhsegi.ent accesses tn th. m e such that n .tn red associatinn ic 
stored for each file for w hich file access re quested hv the propr.^ 

2. (Original)The method of claim 1, wherein the association is stored as meta data. 

3. (Original)The method of claim I, wherein the association includes a file name for 
the file and a program name for the program. 

4. (Original)The method of claim 3, wherein the association fiirther includes at least 
one of a location of the file, a time of file access, a date of file access, an extension for 
tlie file, and an identification of a user of the program. 

5. (Original)The method of claim 4, wherein the location of the file is in a remote 
data processing system. 

6. (Original)The method of claim 1 , wherein the file request is one of a request to 
open the file, close the file, copy the file, or delete the file. 

7. (Original)The method of claim 1 , wherein the program is a first program and 
wherein a request to open the file originates fi-om the furst program and a request to close 
the file originates fi-om a second program. 
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8. (OriginaOThe method of claim 7, wherein the association includes the second 

program. 

9. (Currently amended)The method of claim 1, wherein the receiving step^ 
identifying ste p. , and the storing step are performed within an operating system kernel. 

10. (Cun-ently amended)The method of claim 1. wherein the receiving stcpJM 
identifying ste p, and the storing step are perfonned within a device driver. 

1 1 . (Original)The method of claim 1 0, wherein the drive driver intercepts calls 
directed to a mechanism used as a point of entry for the access. 

12. (Original)The method of claim 1. wherein the storing step comprises: 
storing the association between the file and the program in a database. 

13. (Original)The method of claim 1. wherein associations are stored in a database 
and further comprising: 

receiving a request from a requestor to access the associations; 

querying the database for tlie associations; 

receiving a result from the database; and 

returning the resuh returned from the database to the requestor. 

1 4. (Original)The method of claim 1 3, wherein the associations are for a particular 
program. 

15. (Original)The method of claim 13, wherein the associations are for a particular 
file. 

1 6. (Original)The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in at least one of a 

registry, file, and a file system. 
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1 7. (Currently aniended)A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instmctions to receive a file access request from a program, wherein 
the file access request is for a file and is received at an operating system level; identify an 
association between the file and the program r.n ....Hng the fil. ...... 

receiving the file access request; and store the [[an]] association between the file and the 
program , wherein the association is used for ..u bseguenl prr....ses to the file .nnh th.t . 

stored association is stored for each file for whi.h fil e access r>.^ „..t ed bv the p rnp-.^ 

18. (Original)The data processing system of claim 17, wherein the bus system is a 
single bus. 

19. (OriginaDThe data processing system of claim 17, wherein the bus system 
includes a primary bus £«id a secondary bus. 

20. (Original)The data processing system of claim 17, wherein the processing unit 
includes a plurality of processors. 

21. (Original)The data processing system of claim 17, wherein the communications 
unit is one of a modem and Ethernet adapter. 

22. (Currently amended)A data processing system for tracking relationships between 
programs and data, the data processing system comprising: 

receiving means for receiving a file access request from a program, wherein the 
fi^^ ^^^^ss ""equest is for a file and is received at an operating system level; 
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iH^n^tifyin p means for identifying an association between the file and the program 
r<>q iip.srine the file access in resnonse to rece iving the file access request; and 

storing means for storing the [[as]] association between the file and the program^ 
wherein the a-^snciation is used for aubseo u ftnt accesses to the file such that a stored 
association is stored for each file for which file access is requested by the program. 

23. (Original)The data processing system of claim 22, wherein the association is 
stored as meta data. 

24. (Original)The data processing system of claim 22, wherein the association 
includes a file name for the file and a program name for the program. 

25. (Original)The data processing system of claim 24, wherein the association further 
includes at least one of a location of the file, a time of file access, a date of file access, an 
extension for the file, and an identification of a user of the program. 

26. (Original)The data processing system of claim 25, wherein the location of the file 
is in a remote data processing system. 

27. (Original)The data processing system of claim 22, wherein the file request is one 
of a request to open the file, close the file, copy the file, or delete the file. 

28. (Original)The data processing system of claim 22. wherein the program is a first 
program and wherein a request to open the file originates fi-om the first program and a 
request to close the file originates from a second program. 

29. (Original)The data processing system of claim 22, wherein the association 
includes the second program. 
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30. (Currently amended)The data processing system of claim 22, wherein the 
receiving »n^=. nc , th^ identifying means, and the storing means are located porformod 
within an operating system kernel. 

3 1 (Currently amended)The data processing system of claim 22, wherein the 
receiving .r^>=^^ n< , thf^ Mentifving means, and the storing means are located performed 
within a device driver. 

32. (Original)The data processing system of claim 3 1 . wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

33. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in a database. 

34. (Original)The data processing system of claim 22, wherein associations are stored 
in a database, wherein the receiving means is a first receiving means, and further 
comprising: , 

second receiving means for receiving a request &om a requestor to access the 
associations; 

querying means for querying the database for the associations; 
third receiving means for receiving a result from the database; and 
returning means for returning the result returned from the database to the 
requestor. 

35. (Original)The data processing system of claim 34, wherein the associations arc for 
a particular program. 

36. (Original)The data processing system of claim 34, wherein the associaUons are for 
a particular file. 
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37. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in at least one 
of a registry, file, and a file system. 

38. (Currently amended)A computer program product in a computer readable medium 
for tracking relationships between programs and data, the computer program product 
comprising: 

first instructions for receiving a file access request firom a program, wherein the 
file access request is for a file and is received at an operating system level; 

second instructions for identifying an association between the file and the 
pro gram requesting the file access in response to receivinc the file access request; and 

third se cond instructions for storing the [[m]] association between the file and the 
program^ wherein the association is used for subse quent accesses to the file such that a 
stored association is stored for each file for which file access is requested by the program. 

39. (Original)The computer program product of claim 38, wherein the association is 
stored as meta data. 

40. (Original)The computer program product of claim 38, wherein the association 
includes a file name for the file and a program name for the program. 

41 . (Original)The computer program product of claim 40, wherein the association 
further includes at least one of a location of the file, a time of file access, a date of file 
access, an extension for the file, and an identification of a user of the program. 

42. (Original)The computer program product of claim 41 , wherein the location of the 
file is in a remote data processing system. 

43. (Original)The computer program product of claim 38, wherein the file request is 
one of a request to open the file, clos the file, copy the file, or delete the file. 
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44 (Original)The computer program product of claim 38, wherein the program is a 
first program anU wherein a request to open the file originates fit>m the first program and 
a request to close the file originates from a second program. 

45. (Original)The computer program product of claim 38, wherein the association 
includes the second program. 

46. (Currently amended)The computer prograrh product of claim 38. wherein the first 
l„.^,.«;.„c .H.c..nnrt instructions, and the tWrd seW instructions are located 
performed within an operating system kernel. 

47. (Currently amended)The computer program product of claim 38. wherein the first 

^i,.c^nnH m.tmctions. and the flurd seeend instructions are located 
performed within a device driver. 

48. (Original)The computer program product of claim 47. wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

49. (Currently amended)The computer program product of claim 38. wherein the 
third socond instructions comprises: 

sub-instructions for storing the association between the file and the program in a 

database. 

50. (Currently amended)The computer program product of claim 38, wherein 
associations are stored in a database and fiirther comprising: 

fourth third instructions for receiving a request from a requestor to access the 

associations; 

fifth fourth mstructions for querying the database for the associations; 
sixth fifth instructions for receiving a result from the database; and 
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seventh snrtfe instructions for returning the result returned from the database to the 
requestor. 

51 . (Original)The computer program product of claim 50, wherein the associations 
are for a particular program. 

52. (OriginaDThe computer program product of claim 50, wherein the associations 
are for a particular file, 

53. (Currently amended)The computer program product of claim 38, wherein the 
third se cond instructions comprises: 

sub-instructions for storing the association between the file and the program in at 

least one of a registry, file, and a file system. 
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